General
-
Target
2024-08-15_511ee30255deca04f6369c20d2a3a2cd_avoslocker_revil
-
Size
5.7MB
-
Sample
240815-h6nfsa1ekb
-
MD5
511ee30255deca04f6369c20d2a3a2cd
-
SHA1
30fc4a344c4b11c93ce0acc2a8fbf288ce90087c
-
SHA256
025d52e9ef609c0c8f779d30f7afdf6bf004b74246cff079d04389e493de95c0
-
SHA512
9385e4b145bf667750816cf149414d8b978b51718f2c004620ba8ccbc63821062c92c6d27bc547b708299bcdd3a5e94566ee5e4ae7b8dd300c064f3da1301998
-
SSDEEP
98304:SkHOjlfNdTPjtSBdk5DwtgwoR8OLkzwrstrjU+1O44CFs2:SrSU5Dwuwo+RwYr54CC
Static task
static1
Behavioral task
behavioral1
Sample
2024-08-15_511ee30255deca04f6369c20d2a3a2cd_avoslocker_revil.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2024-08-15_511ee30255deca04f6369c20d2a3a2cd_avoslocker_revil.exe
Resource
win10v2004-20240802-en
Malware Config
Extracted
remcos
DIAMONT
dsjfndswibebfds.con-ip.com:8635
-
audio_folder
MicRecords
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
remcos.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-L9ZO7Y
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
take_screenshot_option
false
-
take_screenshot_time
5
Targets
-
-
Target
2024-08-15_511ee30255deca04f6369c20d2a3a2cd_avoslocker_revil
-
Size
5.7MB
-
MD5
511ee30255deca04f6369c20d2a3a2cd
-
SHA1
30fc4a344c4b11c93ce0acc2a8fbf288ce90087c
-
SHA256
025d52e9ef609c0c8f779d30f7afdf6bf004b74246cff079d04389e493de95c0
-
SHA512
9385e4b145bf667750816cf149414d8b978b51718f2c004620ba8ccbc63821062c92c6d27bc547b708299bcdd3a5e94566ee5e4ae7b8dd300c064f3da1301998
-
SSDEEP
98304:SkHOjlfNdTPjtSBdk5DwtgwoR8OLkzwrstrjU+1O44CFs2:SrSU5Dwuwo+RwYr54CC
Score10/10-
Adds Run key to start application
-